Principal contractors tend to know their Tier 1 subcontractors well. They have been through procurement, contracts have been agreed and due diligence completed.
But Tier 1 is only the beginning of the delivery chain.
A subcontractor may appoint another subcontractor. That business may use a labour provider or subcontract part of its package again. Workers arriving on site can therefore be employed or engaged by organisations several relationships removed from the principal contractor.
The result is a gap between the supply chain a principal contractor has directly procured and the wider network of businesses and workers actually delivering the project.
That matters because risk does not respect contractual tiers.
Financial instability, tax non-compliance, workforce issues or an unexpected dependency several levels down can still create disruption at project level.
Managing construction supply chain risk therefore requires more than confidence in Tier 1. Principal contractors increasingly need to understand what is happening beneath it.
Why does construction supply chain risk increase below Tier 1?
Subcontracting is fundamental to how construction operates. The issue isn't subcontracting itself; it's what becomes harder to see as the delivery chain grows.
Each additional relationship creates another point at which work, labour and responsibility can move further away from the principal contractor's direct oversight.
A project might begin with a clear list of approved subcontractors, but that list does not necessarily answer some important questions:
Who has each Tier 1 subcontractor subsequently appointed?
Which businesses are actually supplying workers to the project?
Who employs or directly engages those workers?
Have those lower-tier organisations been verified?
Has the supply chain changed since the project started?
Where is the project dependent on a business the principal contractor does not contract with directly?
These questions are becoming increasingly important as principal contractors look to manage commercial, operational and compliance risks across increasingly complex delivery models.
Here are some of the risks that can remain hidden below Tier 1.
1. Unknown lower-tier subcontractors
A principal contractor may have strong visibility of its directly appointed subcontractors without having the same understanding of the businesses those subcontractors appoint.
A Tier 1 contractor might subcontract part of its package to a Tier 2 business. That organisation could introduce another specialist contractor or labour provider.
Before long, the businesses actually delivering work can look quite different from the original list of directly contracted suppliers.
The risk isn't simply that more companies exist in the chain. It's that the principal contractor may struggle to answer a basic question: who is actually delivering this project?
Without a clear contractor hierarchy, identifying who introduced a business, where it sits in the chain and which work or workers are associated with it can become a manual investigation.
2. Workers linked to the wrong employer
Knowing who has entered a construction site is valuable.
Knowing who actually employs or directly engages them is a different question.
In a multi-tier supply chain, workers may be supplied through subcontractors, labour providers and other intermediaries. If the worker-to-employer relationship isn't clear, it becomes harder to establish which organisation is responsible when a workforce issue arises.
That can create practical problems for project, workforce and compliance teams.
If an issue is identified with a worker tomorrow, could you immediately establish who employs them?
And could you then see where that employer sits within the wider subcontractor chain?
Workforce visibility without employer visibility can leave an important piece of the assurance picture missing.
3. Unverified businesses entering the project
Due diligence at procurement stage is important, but it can only cover the organisations you know about.
A lower-tier contractor introduced later may not have been through the same process as a directly appointed supplier.
That can leave principal contractors with organisations operating within the project delivery chain that haven't received the same level of scrutiny.
The challenge becomes greater if contractor information sits across different databases, spreadsheets and project records.
A business name alone also isn't necessarily enough. Reliable contractor identification matters if teams are going to distinguish between verified businesses, duplicate records and organisations requiring further investigation.
Subcontractor due diligence therefore needs to consider not only the suppliers appointed at the start, but how new organisations enter the project throughout delivery.
4. Financial failure deeper in the supply chain
The failure of a lower-tier supplier can still become the principal contractor's problem in practice.
Construction remains the industry with the highest absolute number of company insolvencies in England and Wales. According to the Insolvency Service, 3,805 construction companies entered insolvency in the 12 months to June 2026, accounting for 17% of cases where industry was captured.
A business several tiers below the principal contractor might be responsible for a specialist activity, supply a significant number of workers or sit within a critical package.
If that organisation fails, the contractual distance between it and the principal contractor does little to prevent the operational consequences.
Workers can disappear. Packages can stall. Replacement suppliers may need to be found. Programmes may need to be resequenced.
Financial risk management therefore shouldn't only ask whether Tier 1 suppliers are financially resilient.
It should also ask where critical delivery depends on businesses further down the chain.
5. Hidden supplier dependencies
Financial failure is particularly significant when a project is dependent on a single lower-tier organisation.
Consider a specialist subcontractor several tiers down delivering an activity on the critical path.
From a procurement perspective, it may look like the Tier 1 contractor owns that risk.
From a project delivery perspective, however, the principal contractor will still feel the consequences if that lower-tier organisation can no longer deliver.
This is why construction supply chain risk management needs to consider relationships as well as individual companies.
The important question isn't only:
“Is this contractor a risk?”
It is also:
“What happens to our project if this contractor fails?”
Identifying sole-supplier relationships and concentrations of labour or specialist capability can reveal risks that aren't obvious from the Tier 1 contract alone.
6. CIS and tax risk within the supply chain
Tax risk is another reason why understanding lower-tier relationships is becoming more important.
Changes to the Construction Industry Scheme came into effect on 6 April 2026, strengthening HMRC's powers to tackle fraud.
Where a business makes a payment for construction operations and knew, or should have known, that it was connected to deliberate non-compliance by another party, HMRC now has powers that can include making a determination relating to the tax lost, charging a penalty and immediately cancelling Gross Payment Status.
For principal contractors, the important wider lesson is that relying solely on the direct commercial relationship with a Tier 1 subcontractor is becoming harder to reconcile with effective supply chain risk management.
Businesses need proportionate processes that help them understand their labour supply chains, identify warning signs and investigate relationships that warrant greater scrutiny.
Visibility doesn't remove tax risk or guarantee compliance. But it can make it considerably easier to understand what is happening within the chain and evidence the steps taken when something doesn't look right.
7. Labour exploitation and modern slavery risks
Complex subcontracting can also make it harder to understand the conditions under which labour has entered a project.
UK Government analysis has previously identified construction workers as potentially vulnerable to exploitation because of structural characteristics including temporary migrant labour, fragmented supply chains and low-cost tendering.
Multiple tiers can make identifying the actual employer or labour provider more difficult, particularly where responsibility for workforce assurance is assumed to sit elsewhere in the chain.
For principal contractors, this makes accurate worker-employer relationships important for more than administration.
Understanding which organisation is supplying or employing a worker provides a starting point for asking the right questions when concerns arise.
It can also help prevent a dangerous assumption: that because a worker arrived through an approved Tier 1 subcontractor, every organisation involved further down the chain has automatically been subject to equivalent scrutiny.
8. Subcontracting depth itself becoming a risk indicator
Not every long subcontractor chain is inherently problematic.
But unexpected subcontracting depth should prompt questions.
If work expected to be delivered by one organisation has passed through several additional companies before reaching the people actually doing it, commercial and compliance teams may want to understand why.
Each additional relationship can introduce another company, another contractual arrangement and another potential point of failure.
It can also make responsibility harder to trace.
The objective shouldn't be to impose an arbitrary limit on the number of tiers a project can have.
Instead, principal contractors need enough visibility to recognise when the delivery model differs materially from what they expected — and investigate where appropriate.
9. Fragmented evidence when something goes wrong
Supply chain risk becomes particularly visible when somebody asks for evidence.
That could be an internal audit, a client request, a tax enquiry or an investigation following a workforce or contractor issue.
If contractor information is held in one system, workforce records in another, supplier checks in spreadsheets and subcontractor relationships in email chains, reconstructing the project position can take considerable effort.
The question quickly changes from:
“Did we have a process?”
to:
“Can we prove what actually happened?”
A defensible audit trail needs more than a current list of suppliers. Teams may need to establish which businesses were involved at a particular point in time, who introduced them, which workers were linked to them, what exceptions were identified and what action was taken.
Trying to assemble that history retrospectively is very different from creating it as the project develops.
10. Point-in-time due diligence becoming outdated
Perhaps the most overlooked construction supply chain risk is change itself.
A project supply chain is not static.
New subcontractors join. Labour providers change. Workers move between employers. Packages are subcontracted further. Businesses encounter financial problems. Relationships that looked low-risk at procurement stage can change during delivery.
That creates a weakness in traditional point-in-time assurance.
A contractor may have passed every required check six months ago. That doesn't necessarily tell you whether the supply chain delivering the project today is the same one you originally assessed.
This is the distinction between supplier onboarding and continuous supply chain assurance.
One asks whether a contractor was acceptable when it entered the process.
The other asks whether the supply chain continues to operate as expected.
For long-running, complex projects, principal contractors increasingly need both.
From supplier due diligence to supply chain assurance
None of these risks means principal contractors should attempt to manage every lower-tier business as though it were a Tier 1 supplier.
That would quickly become unmanageable.
The more practical approach is assurance by exception.
Instead of manually scrutinising every organisation and worker to the same degree, principal contractors need enough visibility to identify the relationships that warrant attention.
What should principal contractors be able to see?
A stronger approach to construction supply chain risk management should make it possible to answer questions such as:
- Who is contracted to whom?
- How many tiers does the project supply chain contain?
- Which lower-tier organisations are actually delivering work?
- Who employs or directly engages each worker?
- Which contractors have been verified?
- Which organisations have entered the project unexpectedly?
- Where does the project depend heavily on one supplier?
- What has changed since the supply chain was originally approved?
- Which exceptions have been investigated?
- What action was taken, by whom and when?
That changes supply chain management from trying to collect more data to identifying the information that actually matters.
The supply chain you procured isn't necessarily the supply chain delivering your project
Construction will always rely on subcontracting.
The challenge for principal contractors isn't to remove that complexity. It's to understand it.
A Tier 1 contract can establish commercial responsibility, but it cannot by itself show every organisation subsequently introduced, who employs every worker or how the delivery chain changes over the life of a project.
And that is where hidden construction supply chain risk develops.
The principal contractors best placed to manage that risk will be those able to connect their contractor relationships with the workforce actually delivering their projects — and identify material exceptions before they become urgent problems.
So perhaps the most useful supply chain risk question isn't:
“Do we know our subcontractors?”
It's:
“How far down our supply chain can we confidently answer that question?”